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UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


UNITED STATES OF AMERICA 
CRIMINAL NO. 21-cr- 


v. 
MICHAEL A. SUSSMANN, : VIOLATIONS: 
: 18 U.S.C. § 1001(a)(2) 
Defendant. ; (Making a False Statement) 
INDICTMENT 
The Grand Jury charges that: 
A. Introduction and Overview 
lk, In or about late October 2016 — approximately one week before the 2016 U\S. 


Presidential election — multiple media outlets reported that U.S. government authorities had 
received and were investigating allegations concerning a purported secret channel of 
communications between the Trump Organization, owned by Donald J. Trump, and a particular 
Russian bank (“Russian Bank-1”’). 

oH According to one of these articles published by a major U.S. newspaper 
(“Newspaper-1’), intelligence officials possessed information concerning “what cyber experts said 
appeared to be a mysterious computer back channel between the Trump Organization and [Russian 
Bank-1].” The article further reported that the Federal Bureau of Investigation (“FBI”) had “spent 
weeks examining computer data showing an odd stream of activity to a Trump Organization 


3 


server,” and that “[c]omputer logs obtained by [Newspaper-1]” showed “that two servers at 
[Russian Bank-1] sent more than 2,700 ‘look up’ messages... to a Trump-connected server 


beginning in the spring.” According to other articles, this information had been assembled by an 
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anonymous computer researcher who used the moniker ““Tea Leaves.”’ 

a The FBI had, in fact, initiated an investigation of these allegations in response to a 
meeting that MICHAEL A. SUSSMANN, the defendant herein — a lawyer at a major international 
law firm (“Law Firm-1”) — requested and held with the FBI General Counsel on or about 
September 19, 2016 at FBI Headquarters in the District of Columbia. SUSSMANN provided to 
the FBI General Counsel three “white papers” along with data files allegedly containing evidence 
supporting the existence of this purported secret communications channel. 

4. During the meeting, SUSSMANN led about the capacity in which he was 
providing the allegations to the FBI. Specifically, SUSSMANN stated falsely that he was not 
doing his work on the aforementioned allegations “for any client,” which led the FBI General 
Counsel to understand that SUSSMANN was acting as a good citizen merely passing along 
information, not as a paid advocate or political operative. In fact, and as alleged in further detail 
below, this statement was intentionally false and misleading because, in assembling and conveying 
these allegations, SUSSMANN acted on behalf of specific clients, namely, (1) a U.S. technology 
industry executive (“Tech Executive-1’’) at a U.S. Internet company (“Internet Company-1’’), and 
(i1) the Hillary Clinton Presidential Campaign (the “Clinton Campaign”). 

oy SUSSMANN’s lie was material because, among other reasons, SUSSMANN’s 
false statement misled the FBI General Counsel and other FBI personnel concerning the political 
nature of his work and deprived the FBI of information that might have permitted it more fully to 
assess and uncover the origins of the relevant data and technical analysis, including the identities 
and motivations of SUSSMANN’s clients. 


6. Had the FBI uncovered the origins of the relevant data and analysis, and as alleged 


ho 
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below, it might have learned, among other things, that (i) in compiling and analyzing the Russian 
Bank-1 allegations, Tech Executive-1 had exploited his access to non-public data at multiple 
Internet companies to conduct opposition research concerning Trump; (i1) in furtherance of these 
efforts, Tech Executive-1 had enlisted, and was continuing to enlist, the assistance of researchers 
at a U.S.-based university who were receiving and analyzing Internet data in connection with a 
pending federal government cybersecurity research contract; and Gu) SUSSMANN, Tech 
Executive-1, and Law Firm-1 had coordinated, and were continuing to coordinate, with 
representatives and agents of the Clinton Campaign with regard to the data and written materials 
that SUSSMANN gave to the FBI and the media. 

ve The FBI’s investigation of these allegations nevertheless concluded that there was 
insufficient evidence to support the allegations of a secret communications channel with Russian 
Bank-1. In particular, and among other things, the FBI’s investigation revealed that the email 
server at issue was not owned or operated by the Trump Organization but, rather, had been 
administered by a mass marketing email company that sent advertisements for Trump hotels and 
hundreds of other clients. 

B. The Defendant 

8. At all times relevant to this Indictment, SUSSMANN was employed at Law Firm- 
1. Previously, SUSSMANN was employed by the U.S. Department of Justice (“DOJ”) in various 
capacities. In his work at the DOJ, SUSSMANN became familiar with U.S. criminal laws, 
including Title 18, United States Code, Section 1001, which criminalizes the making of materially 
false statements to U.S. officials. 


o. In his work at Law Firm-1, SUSSMANN represented numerous clients in 
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cybersecurity, privacy, and national security-related matters. In or about April 2016, the 
Democratic National Committee (“DNC”) retained SUSSMANN to represent it in connection with 
the hacking of its email servers by the Russian government. In connection with his representation 
of the DNC as the victim of a hack, the defendant met and communicated regularly with the FBI, 
the DOJ, and other U.S. government agencies. In or around the same time period, SUSSMANN 
was also advising the Clinton Campaign in connection with cybersecurity issues. 

C. Law Firm-1 and Its Role in the 2016 Presidential Election Campaign 

10. Law Firm-1 was at all times relevant to this Indictment an international law firm 
based in the United States. In or about April 2015, the Clinton Campaign retained Law Firm-1 as 
its counsel for the 2016 U.S. Presidential election. A law partner at Law Firm-1 (‘Campaign 
Lawyer-1”) acted as the Clinton Campaign’s General Counsel. 

ll. As part of its efforts to assist the Clinton Campaign and the DNC, Law Firm-1 
retained a particular investigative Firm (the “U.S. Investigative Firm’’) to gather information 
regarding Trump’s purported ties to Russia. Throughout the Presidential campaign, the U.S. 
Investigative Firm worked with Law Firm-1, members of the media, and others to gather and 
disseminate purported evidence of Trump’s ties to Russia. 

D. Tech Executive-] 

12. Tech Executive-1 was at all times relevant to this Indictment an executive of a 

particular Internet company (“Internet Company-1”), which offers various Internet-related 


services and products, including Domain Name System (“DNS”) resolution services, to its 
customers. (DNS is a naming system for devices connected to the Internet that translates 


recognizable domain names, e.g., http://www.google.com, to numerical IP addresses, e.g., 
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123.456.7.89. A DNS “lookup” refers to an electronic request by a particular computer or device 
to query information from another device or server.) 

13. By virtue of his position at Internet Company-1 and other companies, Tech 
Executive-| maintained direct or indirect access to, and the ability to provide others access to, 
large amounts of internet and cybersecurity data, including DNS data. 

14. In or about February 2015, Tech Executive-1 retained SUSSMANN as his lawyer 
in connection with a matter involving an agency of the U.S. government. SUSSMANN also 
frequently served as outside counsel to Internet Company-1, which was a significant source of 
revenue for Law Firm-1 and SUSSMANN. At all times relevant to this Indictment, Tech 
Executive-1 served as SUSSMANN’s primary point of contact at Internet Company-1. 

La: In or about November 2016, Tech Executive-1 claimed to have been previously 
offered a position in the government in the event Hillary Clinton won the Presidency, stating in an 
email days after the U.S. Presidential election: “I was tentatively offered the top [cybersecurity] 
job by the Democrats when it looked like they’d win. I definitely would not take the job under 
Trump.” 

E. The Russian Bank Allegations 

16. | By inor around late July 2016, the aforementioned computer researcher who used 
the moniker “Tea Leaves” (“Originator-1’’) had assembled purported DNS data reflecting apparent 
DNS lookups between Russian Bank-1 and an email domain, “maill.trump-email.com” (the 
“Russian Bank Data”). The purported data spanned the time period from on or about May 4, 2016 
through on or about July 29, 2016. 


17. At all times relevant to this Indictment, Originator-1 was a business associate of 
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Tech Executive-1. By in or about July 2016, Tech Executive-] and others were in possession of 
the Russian Bank Data. 

18. Also, in or about July 2016, Tech Executive-1 alerted SUSSMANN to the Russian 
Bank Data. 

19. Over the ensuing weeks, and as part of their lawyer-client relationship, 
SUSSMANN and Tech Executive-1 engaged in efforts with Campaign Lawyer-1 and individuals 
acting on behalf of the Clinton Campaign to share information about the Russian Bank Data with 
the media and others, claiming that it demonstrated the existence of a secret communications 
channel between the Trump Organization and Russian Bank-1. 


SUSSMANN Bills the Clinton Campaign for His Communications with Tech Executive-1 and 
Campaign Lawyer-1 


20, From in or about late July through in or about mid-August 2016, SUSSMANN, 
Tech Executive-1, and Campaign Lawyer-1 coordinated and communicated about the Russian 
Bank-1 allegations during telephone calls and meetings, which SUSSMANN billed to the Clinton 
Campaign (denoted in Law Firm-1’s billing records by its official corporate name, “HFACC, 
Ties): 

a. For example, on or about July 29, 2016, SUSSMANN and Campaign Lawyer-|] 
met with personnel from the U.S. Investigative Firm in Campaign Lawyer-l’s office. 
SUSSMANN billed his time in this meeting to the Clinton Campaign under the category “General 
Political Advice” with the billing description “meeting with [Campaign Lawyer-1], others 
regarding [] confidential project.” (For all of SUSSMANN’s other billing entries cited herein that 
he billed to the Clinton Campaign, he similarly billed his time to the campaign under the category 


“General Political Advice’’). 
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b. On or about July 31, 2016, SUSSMANN billed the Clinton Campaign for twenty- 
four minutes with the billing description, “communications with [Campaign Lawyer-1] regarding 
server issue.” 

c. On or about August 12, 2016, SUSSMANN, Campaign Lawyer-1, and Tech 
Executive-1 met in Campaign Lawyer-1’s office. In connection with this meeting, SUSSMANN 
billed his time to the Clinton Campaign with the billing description “confidential meetings with 
[Campaign Lawyer-1], others.” 

d. In or around the same time period, SUSSMANN, Campaign Lawyer-1, and 
personnel from the U.S. Investigative Firm began exchanging emails with the subject line, 
“Connecting you all by email.” 

e. On or about August 17, 2016, SUSSMANN, Campaign Lawyer-1, and Tech 
Executive-1 conducted an additional conference call. SUSSMANN billed this time to the Clinton 
Campaign with the billing descriptions “telephone conference with [Tech Executive-1], 
[Campaign Lawyer-1].” 

f. Onor about August 19, 2016, SUSSMANN and Campaign Lawyer-1 conducted an 
additional in-person meeting that appeared in SUSSMANN’s calendar as “Meeting with {Tech 
Executive-1’s first name].”” SUSSMANN billed this time to the Clinton Campaign within the 
billing description stating, in part, “confidential meeting with [Campaign Lawyer-1], others[.]” 

g. Later in or about August 2016, Tech Executive-1 exchanged emails with personnel 


from the U.S. Investigative Firm. 


Tech Executive-1 Uses His Access at Multiple Internet Companies to Conduct Opposition 
Research and Create a “Narrative” Regarding Trum 





pale As alleged in further detail below, in or around the same time period — and in 


7 


Sos 
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turtherance of his efforts with SUSSMANN and Campaign Lawyer-1 to disseminate allegations 
regarding Trump — Tech Executive-1 used his access at multiple organizations to gather and mine 
public and non-public Internet data regarding Trump and his associates, with the goal of creating 
a “narrative” regarding the candidate’s ties to Russia. 
22. Tech Executive-1 later shared certain results of these data searches and analysis 
with SUSSMANN so that SUSSMANN, in turn, could provide them to the media and the FBI. 
Tech Executive-1 Obtains Internet Data Relating to Trump from Internet Company-2 

a. For example, in or about early August 2016 — the same time period of his 
aforementioned communications with SUSSMANN and Campaign Lawyer-1 — Tech Executive- 
1 directed and caused employees of two companies in which he had an ownership interest 
(“Internet Company-2” and “Internet Company-3”’) to search and analyze their holdings of public 
and non-public internet data for derogatory information on Trump. 

b. At all times relevant to this Indictment, Internet Company-2 was a company that, 
among other things, collected DNS data from various points on the Internet. 

c. Atall times relevant to this Indictment, Internet Company-3 was owned by the same 
company as Internet Company-2. As part of its business, Internet Company-3 received data that 
had been collected by Internet Company-2 or its parent company, and then used and analyzed that 
data in order to advise its private sector customers on cybersecurity and business risks. 

d. In or about early August 2016, Tech Executive-1 called an individual at Internet 
Company-3. During the call, Tech Executive-1 instructed the individual to task Internet 
Company-3 employees to search for any Internet data reflecting potential connections or 


communications between Trump or his associates and Russia. 
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e. In connection with this tasking, Tech Executive-1 later stated that he was working 
with someone who had close ties to the Democratic Party and to Hillary Clinton. 

f. The aforementioned individual and other personnel at Internet Company-3 were 
uncomfortable regarding this tasking from Tech Executive-1 because they believed that using the 
companies’ data in this manner was inappropriate. They complied with the tasking, however, 
because Tech Executive-1 was a powerful figure at both companies. 

g. In connection with this tasking, Tech Executive-1 emailed to Internet Company-3 
personnel a five-page document (the “Trump Associates List’) listing six associates of Trump and 
a purported U.S.-based lobbyist for Russian Bank-1 who was also discussed in written materials 
prepared by the U.S. Investigative Firm that SUSSMANN would later provide to the FBI General 
Counsel. The Trump Associates List contained detailed personal information for these 
individuals, including, for example, their names, home addresses, personal email addresses, 
business names, business websites and email domains, suspected IP addresses for those domains, 
and information pertaining to the spouse of one of these associates. Tech Executive-1 directed 
that these individuals should be a focus of Internet Company-3’s data queries and analysis. 

h. On or about August 15, 2016, employees of Internet Company-2, acting at the 
request of Internet Company-3, queried their holdings of non-public Internet data against a lengthy 
list of more than 9,000 IP addresses, 3,000 internet domains, and 60 email addresses and domains 
that related or referred to Trump, the Trump Organization, the aforementioned Trump associates, 
and/or Russian Bank-! (i.e., the bank that was the subject of the allegations that SUSSMANN later 
conveyed to the FBI General Counsel). 


i. During the same time period, employees of Internet Company-3 also drafted and 
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provided to Tech Executive-1 a written paper reflecting, in substance, some of the same technical 
observations contained in the Russian Bank-1 allegations that SUSSMANN later conveyed to the 
FBI. 


Tech Executive-1 Tasks Originator-1 and University Researchers to Search for Internet Data 
Regarding Trump 


25. Also in or around the same time period, and in connection with Tech Executive-1’s 
joint efforts with SUSSMANN, Tech Executive-1 similarly tasked Originator-1 and two computer 
researchers (“Researcher-1” and ‘“Researcher-2”) who worked at a U.S.-based university 
(“University-1”) to search broadly through Internet data for any information about Trump’s 
potential ties to Russia. In connection with this tasking, and as alleged in further detail below, 
Tech Executive-1’s goal was to support an “inference” and “narrative” regarding Trump that 
would please certain “VIPs.” Moreover, and as alleged below, Tech Executive-1 provided 
information that he gathered through these interactions to his lawyer, SUSSMANN, so that 
SUSSMANN could assist in drafting and disseminating materials to the media and the FBI. 

Background on the Agency-! Contract 

a. At the time of these exchanges in or about August 2016, a federal government 
agency (“Agency-1”) was in the process of finalizing, but had not yet signed, a cybersecurity 
research contract with University-1 (the “Agency-1 Contract”). The primary purpose of the 
Agency-1 Contract was for University-1 researchers to receive and analyze large quantities of 
public and non-public data (including DNS data) from various Internet companies in order to 
identify the perpetrators of malicious cyber-attacks and protect U.S. national security. 

b. Originator-1 was not a participant in the contract but was the founder of a company 


that University-1 researchers were considering as a potential data provider under the contract. 


LQ 
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c. Tech Executive-1 and his employer, Internet Company-1, would ultimately sell 
large amounts of historical and ongoing DNS data to University-1 for use and analysis under the 
Agency-! Contract. 

d. Although the Agency-1 Contract was not signed until in or around November 
2016, Internet Company-1 — through Tech Executive-1 — provided University-1 with early access 
to its Internet data in order to establish a “proof of concept” for work under the contract. Among 
the data that University-1 accessed through Internet Company-1 was the DNS data of an Executive 
Branch office of the U.S. government (“Office-1’’), which Internet Company-1 had come to 
possess as a sub-contractor in a sensitive relationship between the U.S. government and another 
company. 

e. The purpose of providing Internet Company-1’s data to University-1 during this 
time period was to enable researchers who worked niidler the Agency-1 Contract to protect U.S. 
networks from cyberattacks. From in or about July 2016 through at least in or about February 
2017, however, Originator-1, Researcher-1, and Researcher-2 also exploited Internet Company- 
1°s data and other data to assist Tech Executive-1 in his efforts to conduct research concerning 
Trump’s potential ties to Russia, including the Russian Bank-1 allegations that SUSSMANN 
would later convey to the FBI. 

Research Concerning Trump 
f. For example, on or about July 29, 2016, Researcher-2 emailed to Researcher-1 the 
Russian Bank Data compiled by Originator-1. 
g. On or about August 19, 2016, Researcher-1 queried internet data maintained by 


Internet Company-1 for the aforementioned mail1.trump-email.com domain that was the subject 


| 
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of the allegations SUSSMANN would later convey to the FBI. Researcher-1 then emailed Tech 
Executive-1 and others a list of domains that had communicated with it — none of which appeared 
to have links to Russia. Researcher-1 noted that the list “does not make much sense with the 
storyline you have,” referring to the storyline connecting Trump to Russia. 

h. On or about August 20, 2016, Originator-1 emailed Tech Executive-1, Researcher- 
1, and Researcher-2, stating, among other things, that “even if we found what [Tech Executive-1] 
asks us to find in DNS, we don’t see the money flow, and we don’t see the content of some message 
saying ‘send the money here’.” Originator-1 then explained that it would be possible to “fill out 
a sales form on two websites, faking the other company’s email address in each form,” and thereby 
cause them “to appear to communicate with each other in DNS.” Originator-1 then concluded: 
“I[f] [Tech Executive-1] can take the *inference* we gain through this team exercise . . . then work 
to develop even an inference may be worthwhile. . . .It’s just not the case that you can rest assured 
that Hillary’s opposition research and whatever professional gov[ernments] and investigative 
journalists are also digging [will] come up with the same things[.]” (asterisks in original). 

i. Onor about the same date, Tech Executive-1 clarified in an email to Originator-1, 
Researcher-1, and Researcher-2 that the “task” he had given them was “indeed broad” and further 
stated, in part: 

Being able to provide evidence of *anything* that shows an attempt 

to behave badly in relation to this, the VIPs would be happy. They’re 

looking for a true story that could be used as the basis for closer 

examination. 

(emphasis added; asterisks in original). Regarding the Russian Bank-1 allegations that he had 


provided to SUSSMANN, Tech Executive-1’s email stated: “[T]he prior hypothesis was all that 


they needed: [a] mailserver dedicated or related to [T]rump . . . and with traffic almost exclusively 
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with [Russian Bank-1] was sufficient to do the job.” Tech Executive-! continued, “Trump has 
claimed he and his compan[ies] have had NO dealings with .ru other than the failed Casino, and 
the Miss universe pageant. He claims absolutely NO interaction with any financial institutions. 
So any potential like that would be jackpot.” 

j. Onor about August 21, 2016, Tech Executive-1 emailed the recipients, urging them 
to push forward with additional research concerning Trump, which he stated would “give the base 
of a very useful narrative.” Later in the same email, Tech Executive-1 expressed his own belief 
that the “trump-email.com” domain (referring to the subject of the allegations that SUSSMANN 
conveyed to the FBJ) was not a secret communications channel with Russian Bank-1, but “a red 
herring,” noting that the host for that domain “is a legitimate valid [customer relationship 
management] company.” Tech Executive-1 therefore concluded that “we can ignore it, together 
with others that seem to be part of the marketing world.” 

k. On or about August 22, 2016, Researcher-1 emailed the aforementioned recipients, 
expressing continued doubt regarding the Russian Bank-1 allegations that SUSSMANN would 
later convey to the FBI, and raising concerns about the researchers’ bias against Trump: 

Let[’|s for a moment think of the best case scenario, where we are able 

to show (somehow) that DNS [] communication exists between Trump 

and R[ussia]. How do we plan to defend against the criticism that 

this is not spoofed || traffic we are observing? There is no answer to 

that. Let’s assume again that they are not smart enough to refute our 

“best case” scenario. [Tech Executive-1], you do realize that we will 

have to expose every trick we have in our bag to even make a very 

weak association? Let[‘]s all reflect upon that for a moment. Sorry 

folks, but unless we get combine netflow and DNS traffic collected at 


critical points between suspect organizations, we cannot technically 
make any claims that would fly public scrutiny. 


|. ..| 
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The only thing that drive|s| us at this point is that we just do not 
like [Trump]. This will not fly in eyes of public scrutiny. Folks, I 
am afraid we have tunnel vision. Time to regroup? 


(emphasis added). 


SUSSMANN and His Client Prepare a White Paper Summarizing the Russian Bank-1 
Allegations 


24. Despite the aforementioned views that the Russian Bank Data and allegations were 
a “red herring” that should be “ignored,”” SUSSMANN, Tech Executive-1, Ornginator-1, and the 
University-1 researchers began to draft, review, and revise a “white paper’ summarizing the 
Russian Bank-1! allegations that SUSSMANN would later provide to the FBI. SUSSMANN 
continued to bill time on these matters to the Clinton Campaign. 

a. For example, on or about September 5, 2016, SUSSMANN began billing work for 
the drafting of the aforementioned white paper. SUSSMANN billed this work to the Clinton 
Campaign with a billing description that read, in part, “work on white paper; follow-up telephone 
conferences and email.” (emphasis added). 

b. On or about September 6, 2016, SUSSMANN continued to work on the white 
paper. On or about the same date, SUSSMANN also met with representatives of the U.S. 
Investigative Firm and communicated with the media. SUSSMANN billed this work to the 
Clinton Campaign with the billing description, “Meeting with consultant [and Campaign Lawyer- 
1]; revisions to white paper; meeting with expert; meeting with expert and reporter; follow- 
up meeting with reporter; conversations with [Campaign Lawyer-1 |.” (emphasis added). 

c. On or about September 7, 2016, SUSSMANN continued work on the white paper. 
SUSSMANN billed his time for that work to the Clinton Campaign with the billing description, 


“Meetings and other communications regarding confidential project; work on written materials.” 
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(emphasis added). 

d. On or about September 14, 2016 — five days before his meeting with the FBI 
General Counsel - SUSSMANN continued work on the white paper. SUSSMANN also met with 
Tech Executive-1 in SUSSMANN’s office. On or about the same date, SUSSMANN billed time 
to the Clinton Campaign with the billing description “Multiple meetings regarding confidential 
project, draft white paper [],” and to Internet Company-1 with the billing description, 
“communications regarding confidential project.” (emphasis added). 

e. On or about the same day — and just five days before SUSSMANN conveyed the 
aforementioned allegations to the FBI — Tech Executive-1 sent the white paper that SUSSMANN 
had been working on to Originator-1, Researcher-!, and Researcher-2. In an email, Tech 
Executive-1 sought their views as to whether the paper’s allegations would be “plausible” to 
“security experts,” even if the allegations were not demongnatle true: 

Please read as if you had no prior knowledge or involvement, and 
you were handed this document as a security expert (NOT a dns 
expert) and were asked: ‘Is this plausible as an explanation?’ NOT 
to be able to say that this is, without doubt, fact, but to merely 
be plausible. Do NOT spend more than a short while on this (If 


you spend more than an hour you have failed the assignment). 
Hopefully less. :) 


(emphasis added). 

f. On or about the same date, Researcher-1 replied, stating that the white paper 
achieved Tech Executive-1’s objective, but noting that the paper “smartly” avoided discussing 
weaknesses or “holes” in the paper’s hypothesis: 

A DNS expert would poke several holes to this hypothesis 
(primarily around visibility, about which very smartly you do not 


talk about). That being said, I do not think even the top security 
(non-DNS) researchers can refute your statements. Nice! 


I> 
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(emphasis added), 

g. On or about September 15, 2016, Originator-1 responded to Tech Executive-1, 
stating, in part, that the paper’s conclusion was “plausible” in the “narrow scope” defined by Tech 
Executive-1. 

h. On or about the same date, Reseacher-2 replied, acknowledging that questions 
remained, but stating, in substance and in part, that the paper should be shared with government 
officials. 

i. On or about September 16, 2016, Originator-1 replied to the aforementioned 
recipients, discussing an allegation that SUSSMANN would soon convey to the FBI regarding 
Russian Bank-1’s alleged use of a purported “TOR exit node” (i.e., a node used for anonymized 
internet traffic) at a particular U.S.-based healthcare company (“Healthcare Company-1’’) to 
communicate with the Trump Organization. Originator-1’s email stated, in part, “{Tech 
Executive-1] has carefully crafted a message that could work to accomplish the goals.” 

SUSSMANN Shares the Russian Bank-1 Allegations with the Media 
25. In or around the same time period, SUSSMANN, acting on behalf of Tech 
Executive-! and the Clinton Campaign, disseminated the Russian Bank-1 allegations to the media. 
SUSSMANN billed this time to the Clinton Campaign. 

a, For example, on about August 30, 2016, Reporter-1 — who would later author the 
above-referenced October 31, 2016 article about the Russian Bank-1 allegations — emailed 
SUSSMANN: “T’m back in town. I see Russians are hacking away. [A]ny big news?” 

b. SUSSMANN replied on the same date: “Mind reader! ... Can you meet Thurs and 
Fri?” 
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c. Onor about September 1, 2016, SUSSMANN met with Reporter-1. SUSSMANN 
billed his time for the meeting to the Clinton Campaign under the broader billing description 
“confidential meetings regarding confidential project.” 

d. On or about September 12, 2016, SUSSMANN spoke with Campaign Lawyer-1] 
via phone regarding SUSSMANN’s efforts to communicate with Newspaper-1 regarding the 
Russian Bank-1 allegations. SUSSMANN and Campaign Lawyer-1! each billed the call to the 
Clinton Campaign with Campaign Lawyer-1 using the billing description “teleconference with M. 
Sussmann re: [Newspaper-1],” and SUSSMANN using the description “work regarding 
confidential project.” | 

e. On or about September 15, 2016, Campaign Lawyer-1 exchanged emails with the 
Clinton Campaign’s campaign manager, communications director, and foreign policy advisor 
concerning the Russian Bank-1 allegations that SUSSMANN had recently shared with Reporter- 
1. Campaign Lawyer-1 billed his time for this correspondence to the Clinton Campaign with the 
billing entry, “‘email correspondence with [name of foreign policy advisor], [name of campaign 
manager], [name of communications director] re: [Russian Bank-1] Article.” (emphasis added). 

SUSSMANN Prepares for His Meeting with the FBI 
26. From on or about September 17 through on or about September 18, 2016 —ie., the 
weekend before SUSSMANN’s Monday meeting with the FBI General Counsel - SUSSMANN 
continued to work on disseminating the Russian Bank-1 allegations on behalf of Tech Executive- 
1 and the Clinton Campaign, and continued to bill his work to the campaign. 
a. For example, on or about September 17, 2016, SUSSMANN spoke on the phone 


with Researcher-2. During the phone call, SUSSMANN, among other things, requested that 
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Researcher-2 speak on background with members of the media regarding the Russian Bank-1 
allegations, which Researcher-2 did over the course of the following weeks. 

b. On or about the same date, SUSSMANN sent to Researcher-2 an electronic file 
containing materials he would provide two days later to the FBI General Counsel, including, 
among other things, the aforementioned white paper that SUSSMANN had assisted in drafting, 
and another white paper drafted by the U.S. Investigative Firm concerning purported ties between 
Russian Bank-1’s parent company and the Russian government. 

c. SUSSMANN billed all of the aforementioned work on or about September 17, 2016 
to the Clinton Campaign with the billing description “Multiple telephone conferences and other 
communications with experts, media; communications with [Campaign Lawyer-1].” (emphasis 
added). 

d. On or about the next day — Sunday, September 18, 2016 -SUSSMANN continued 
to work on the Russian Bank-1 allegations, and to prepare for his meeting with the FBI. 
SUSSMANN billed this time to the Clinton Campaign with the billing description “Further 
communications and work regarding confidential project.” 

SUSSMANN’s False Statement to the FBI General Counsel 
OM On or about September 19, 2016, SUSSMANN met with the FBI General Counsel 
at FBI Headquarters in the District of Columbia to convey the Russian Bank-1 allegations. No 
one else attended the meeting. During the meeting, the following, in substance and in part, 
occurred: 
a. SUSSMANN stated falsely that he was not acting on behalf of any client, which 


led the FBI General Counsel to understand that SUSSMANN was conveying the allegations as a 
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good citizen and not as an advocate for any client; 

b. SUSSMANN stated that he had been approached by multiple cyber experts 
concerning the Russian Bank-1 allegations; 

c. SUSSMANN provided the names of three cyber experts, but did not name or 
mention Tech Executive-1, the Clinton Campaign, or any other person or company referenced 
above; 

d. SUSSMANN described the allegations of a secret Trump Organization server that 
was in communication with Russian Bank-1, including that Russian Bank-1 had used a TOR exit 
node located at Healthcare Company-1 to communicate with the Trump Organization; 

e. SUSSMANN stated that media outlets were in possession of information about the 
Trump Organization’s secret server, and that a story would be published on Friday of that week; 

f. SUSSMANN provided to the FBI General Counsel two thumb drives and hard copy 
papers, which contained and were comprised of the following: 

1. the aforementioned white — that SUSSMANN had assisted in drafting, 
entitled White Paper #1 Auditable V3, which contained no date or author’s name; 
ii. a white paper drafted by Researcher-2, which was entitled, White Paper 
Comments: Time Series Analysis of Recursive Queries, dated September 19, 2016, and contained 
no author’s name; 
i. the aforementioned white paper drafted by the U.S. Investigative Firm 
regarding Russian Bank-1 and its parent company, which contained no date or author’s name; and 
iv. eight files containing the Russian Bank Data and other purported data and 


information relating to the mail] .trump-emai!.com domain. 
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28. Immediately after the aforementioned September 19, 2016 meeting, the FBI 
General Counsel spoke with the Assistant Director of the FBI’s Counterintelligence Division. 
During their conversation, the FBI General Counsel conveyed the substance of his meeting with 
SUSSMANN. The Assistant Director took contemporaneous handwritten notes which reflect, in 
substance, the above-referenced statements by SUSSMANN and state, in relevant part: 


Michael Sussman[n] — Atty: [Law Firm-1] — said not doing this for any client 
e Represents DNC, Clinton Foundation, etc. 


a 
e Been approached by Prominent Cyber People (Academic or Corp. POCs) 
People like: [three names redacted] 


(emphasis added) 

29. SUSSMANN billed his meeting with the FBI General Counsel to the Clinton 
Campaign with the billing description, “work and communications regarding confidential project.” 

30. . SUSSMANN’s statement to the FBI General Counsel that he was not acting on 
behalf of any client was knowingly and intentionally false. In truth and in fact, and as 
SUSSMANN well knew, SUSSMANN acted on behalf of and in coordination with two specific 
clients of Law Firm-1, i.e., Tech Executive-1 and the Clinton Campaign, in assembling and 
conveying these allegations. In particular, and as also alleged above, Tech Executive-1 consulted 
and relied on SUSSMANN as his lawyer to assist in disseminating the Russian Bank-! allegations. 
Moreover, all or nearly all of SUSSMANN’s recorded time and work relating to the Russian Bank- 
1 allegations prior to the meeting with the FBI (including communications with the media) were 
billed to the Clinton Campaign. Indeed, and as SUSSMANN concealed and failed to disclose, (1) 
SUSSMANN had spent time drafting one of the white papers he provided to the FBI General 


Counsel and billed that time to the Clinton Campaign, and (11) the U.S. Investigative Firm — which 
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at the time was also acting as a paid agent of the Clinton Campaign — had drafted another of those 
white papers. 

3 Il. In addition, and as alleged in further detail below, SUSSMANN testified under oath 
before Congress in 2017 that he, in fact, conveyed the Russian Bank-1 allegations to the FBI 
General Counsel “on behalf of my client.” See Paragraph 44, infra. 

32. In the days following SUSSMANN’s meeting with the FBI General Counsel, and 
as a result of that meeting, the FBI opened an investigation of the Russian Bank-1 allegations. 
SUSSMANN’s false statement to the FBI General Counsel was material to that investigation 
because, among other reasons, it was relevant to the FB] whether the conveyor of these allegations 
(SUSSMANN) was providing them as an ordinary citizen merely passing along information, or 
whether he was instead doing so as a paid advocate for clients with a political or business agenda. 
Had SUSSMANN truthfully disclosed that he was representing specific clients, it might have 
prompted the FBI General Counsel to ask SUSSMANN for the identity of such clients, which, in 
turn, might have prompted further questions. In addition, absent SUSSMANN’s false statement, 
the FBI might have taken additional or more incremental steps before opening and/or closing an 
investigation. The FBI also might have allocated its resources differently, or more efficiently, 
and uncovered more complete information about the reliability and provenance of the purported 
data at issue. 

SUSSMANN Continues to Communicate with the Media on Behalf of His Chents 

cee Further demonstrating that SUSSMANN carried out the aforementioned work on 
behalf of his clients, SUSSMANN continued in the weeks following this meeting to coordinate 


with Tech Executive-1, Campaign Lawyer-1, and the U.S. Investigative Firm to disseminate the 
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Russian Bank-1 allegations to the media. SUSSMANN continued to bill his time for such work 
to the Clinton Campaign. 

34. For example, on or about October 10, 2016, SUSSMANN emailed Reporter-1 a 
link to an opinion article which asserted, in substance and in part, that Newpaper-1’s investigative 
reporters had not published as many stories regarding Trump as other media outlets. The subject 
line of SUSSMANN’s email was “for your editors,” and the body stated, “You should send this 
link to them.” At or around that time, and according to public sources, Reporter-1 was working 
on an article concerning the Russian Bank-1 allegations, but Reporter-1’s editors at Newspaper-1 
had not yet authorized publication of the article. 

35% On or about October 30, 2016, an employee of the U.S. Investigative Firm (the 
“Investigative Firm Employee”) forwarded another reporter (“Reporter-2”) a tweet, which 
indicated that the FBI Director had “explosive information about Trump’s ties to Russia.” The 
Investigative Firm Employee’s email stated, “time to hurry,” suggesting that Reporter-2 should 
hurry to publish an article regarding the Russian Bank-1 allegations. In response, Reporter-2 
emailed to the Investigative Firm Employee a draft article regarding the Russian Bank-] 
allegations, along with the cover message: “Here’s the first 2500 words.” 

36. On or about the following day, October 31, 2016, both Reporter-1 and Reporter-2 
published articles regarding the Russian Bank-1 allegations. 

Df. On or about the same date, SUSSMANN continued to communicate with several 
reporters about the media coverage, billing these communications to the Clinton Campaign with 
the billing description, “Communications regarding [Reporter-2’s employer] story, [Newspaper- 


1] reporting; communications with [another news outlet].” 
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38. Soon after the 2016 U.S. Presidential election, the Clinton Campaign ceased to 
exist, and SUSSMANN stopped billing his recorded time on these matters to the Clinton 
Campaign. In the ensuing months, SUSSMANN billed some of his time on the Russian Bank-1 
allegations and related matters to Tech Executive-1. 

SUSSMANN Repeats His False Statement to Another Government Agency 

30, In or about late 2016 and early 2017, Tech Executive-1, Originator-1, and 
Researcher-2 continued to compile additional information and data regarding the Russian Bank-1] 
allegations, and gathered other purported data allegedly involving Trump-related computer 
networks and Russia (collectively, the “Updated Allegations”). SUSSMANN would later convey 
these allegations to another U.S. government agency (“Agency-2”). In doing so, and as alleged 
below, SUSSMANN repeated, in substance, the same false statement he had made to the FBI 
General Counsel that he was not acting on behalf of a client. 

SUSSMANN Seeks a Meeting with Agency-2 

40. In or about late December 2016, SUSSMANN contacted the General Counsel of 
Agency-2 to set up a meeting regarding the Updated Allegations, but the meeting did not go 
forward. 

41. Approximately one month later, SUSSMANN contacted a former employee of 
Agency-2 (the “Former Employee’’) in a further attempt to obtain a meeting at Agency-2. The 
Former Employee communicated with SUSSMANN on or about January 31, 2017, during which 
the following, in substance and in part, occurred: 

a. Contrary to his prior false representation to the FBI General Counsel and a 


representation he would subsequently make to Agency-2 (see below), SUSSMANN advised the 
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Former Employee that he represented a “client.” 

b. SUSSMANN summarized the Updated Allegations. 

c. SUSSMANN requested that the Former Employee assist him in obtaining a 
meeting with Agency-2 and stated that if Agency-2 was not interested, SUSSMANN’s client 
would likely go to Newspaper-1 with the allegations. 

SUSSMANN Repeats His False Statement to Agency-2 
42. On or about February 9, 2017, SUSSMANN met with two Agency-2 employees 
(“Employee-1” and “Employee-2”) at a location outside the District of Columbia. At the meeting, 
the following, in substance and in part, occurred: 

a. SUSSMANN stated falsely — as he previously had stated to the FBI General 
Counsel — that he was “not representing a particular client.” In truth and in fact, and as 
SUSSMAN had acknowledged to the Former Employee just days earlier, SUSSMANN was 
representing a client. 

b. SUSSMANN disclosed that Law Firm-1 was active in representing several 
Democratic Party causes and officer-holders, including both the DNC and Hillary Clinton. 
SUSSMANN stated, however, that such work was unrelated to his reasons for contacting Agency- 
2. 

c. SUSSMANN discussed and described the Updated Allegations, including new 
details concerning the Russian Bank-1 allegations that he had not provided to the FBI General 
Counsel. 

d. SUSSMANN provided to the Agency-2 Employees (1) several white papers, and 


(11) multiple data files containing purported DNS data, ranging from 2016 through early 2017. 
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43. After the meeting with SUSSMANN, Employee-1 and Employee-2 drafted and 
revised a Memorandum for the Record that reflected the above-described statements by 
SUSSMANN. 


SUSSMANN Contradicts His False Statements in Testimony Before Congr 





44. In or about December 2017, SUSSMANN testified under penalty of perjury before 
staffers of the House Permanent Select Committee on Intelligence, which was investigating 
Russian interference and other matters relating to the 2016 Presidential election. During his 
testimony, SUSSMANN directly contradicted his false statements to the FBI and Agency-2 that 
he was not acting on behalf of any client: 

Q: [] When you decided to engage the two principals, one, [the FBI 

General Counsel] in September, and the general counsel of 


[Agency-2] in December, you were doing that on your own 
volition, based on information another client provided you. Is that 


correct? 

A: No. 

Q: So what was -- so did your client direct you to have those 
conversations? 

A: Yes. 


Q: Okay. And your client also was witting of you going to [redacted] 
in February to disclose the information that individual had provided 


you? 
A: Yes 
[ss | 
Q: Okay. I want to ask you, so you mentioned that your client directed 


you to have these engagements with the FBI and [redacted] and to 
disseminate the information that client provided you. Is that correct? 
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A: Well, I apologize for the double negative. It isn’t not correct, but 
when you say my client directed me, we had a conversation, as 
lawyers do with their clients, about client needs and objectives and 
the best course to take for a client. And so it may have been a 
decision that we came to together. I mean, I don't want to imply that 
I was sort of directed to do something against my better judgment, 
or that we were in any sort of conflict, but this was -- I think it's 
most accurate to say it was done on behalf of my client. 


(emphasis added). 
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COUNT ONE 

45. Paragraphs 1 to 44 are incorporated by reference. 

46. Onor about September 19, 2016, within the District of Columbia, MICHAEL A. 
SUSSMANN, the defendant, did willfully and knowingly make a materially false, fictitious, and 
fraudulent statement or representation in a matter before the jurisdiction of the executive branch 
of the Government of the United States, to wit, on or about September 19, 2016, the defendant 
stated to the General Counsel of the FBI that he was not acting on behalf of any client in conveying 
particular allegations concerning a Presidential candidate, when in truth, and in fact, and as the 
defendant well knew, he was acting on behalf of specific clients, namely, Tech Executive-1 and 
the Clinton Campaign. 


(In violation of Title 18, United States Code, Section 1001(a)(2)) 
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